Ron Holley/ed approved by board on

All businesses engaged in commercial activities must comply with the Personal Information Protection and Electronic Documents Act (the “Act”), and the Canadian Standards Association Model Code for the Protection of Personal Information, which it incorporates. The Act sets out rules for the collection, use and disclosure of a client’s personal information, and requires safeguards to protect the confidentiality of that information in the course of conducting business. To ensure that it complies with the Act, CBDC Central PEI has developed this Policy, and trained its directors and staff about the requirements of this Policy.

• 
  a bank or credit union;
  
• 
  an insurance company;
  
• 
  a real estate agent in a property transaction;
  
• 
  government agencies or registries;
  
• 
  credit bureaus or consumer reporting agencies;
  
• 
  a client’s employer;
  
• 
  a client’s lawyer;
  
• 
  a client’s accountant.
  

By signing an application for a loan or other program, a client consents to the CBDC collecting, using and disclosing the information referred to in the Application. Normally, consent in writing is requested, but in some circumstances, a client’s oral consent is accepted. Sometimes, consent may be implied through a client’s conduct with us.

• 
  required or authorized by law to do so;
  
• 
  a client has consented to the disclosure;
  
• 
  it is necessary in order to establish or collect sums owing to us;
  
• 
  we engage a third party to provide administrative services to us (like computer back-up services or archival file storage);
  
• 
  the information is already publicly known.
  

In addition, a client’s personal information will be disclosed to third parties in order to facilitate the granting of a loan. Examples of those third parties include lawyers acting in connection with the loan and the security being taken to support it. In those instances, a client’s consent will be implied, and we will release the information unless the client tells us otherwise.

• 
  premises security;
  
• 
  restricted access to personal information;
  
• 
  deploying technological safeguards like security software and firewalls to prevent hacking or unauthorized computer access;
  
• 
  internal password and security policies.
  

A client’s right to access personal information is not absolute. Access may be denied when:

• 
  denial of access is required or authorized by law;
  
• 
  granting access would have an unreasonable impact on other people's privacy;
  
• 
  to protect the CBDC's rights and property;
  

• 
  where the request is frivolous or vexatious.
  

If a request for access is denied, or a request to correct information is refused, an explanation is offered by the CBDC.

Fair information practices suggest that personal information should only be retained for as long as necessary for the fulfilment of the purposes for which it is collected, but when information is used to make a decision about someone, it should be retained long enough for the individual to be able to access it, and appeal any denial of access. When personal information is no longer needed to fulfil those identified purposes, it should be destroyed, erased or anonymized according to the suggested procedures below.

Disposal of personal information should be carried out in a secure manner and should follow the approved records retention schedule and process for CBDC Central PEI and the classification of records under consideration. Whether CBDC records assigned for disposal consist of paper or electronic records, disks, hard drives, or surveillance tapes, CBDCs have a responsibility to ensure that their practices and measures to properly dispose of personal information in their custody meet the safeguard obligations under personal information protection laws. For example, CBDCs may hire a paper disposal company to securely shred their records and receive confirmation that shredding was completed. As for the disposal of disks and diskettes, CBDCs must ensure a complete wipe or destruction of personal information. Any hardware components must have all data removed; where this is not possible, the hardware must be disposed of in accordance with CBDC safeguard policies and procedures.

1. 
   Ensure material for shredding is a record that has completed its scheduled retention; or is a non-record or transitory record containing sensitive information.
   
2. 
   Confirm that there is no active Legal Investigation/Audit relating to the records you are planning to dispose.
   
3. 
   Complete and retain a certificate of disposition for all records in accordance with approved retention and disposal schedules.
   

CBDC Central PEI

11 Water St.

Summerside, PE, C1N 1A2

112 Kent Street

Place de Ville, Tower B, 3rd Floor

Ottawa, ON K1A 1H3

Fax: 613-947-6850

Inquiries: 1-800-282-1376 (toll-free)

• 
  Conflict of Interest Policy
  
• 
  Complaint Resolution Policy
  

January 24^th, 2014